Home Tech This new Python malware is going after Windows machines

This new Python malware is going after Windows machines

by pfuwi
0 comment

Cybersecurity researchers from Securonix have recently discovered a new Python-based malware that’s capable of stealing files and logging keystrokes from affected endpoints.

Dubbed PY#RATION, the malware is apparently being actively developed, with the researchers spotting multiple versions since August 2022. The malware uses the WebSocket protocol to reach out to the command & control (C2) server, get instructions, and potentially extract sensitive data. 

Securonix say the malware “leverages Python’s built-in Socket.IO framework, which provides features to both client and server WebSocket communication.” The malware uses this channel to pull data and receive commands. The advantage of WebSocket, the publication claims, is that it allows the malware to receive and send data over a single TCP connection, via commonly open ports, at the same time.

Multiple features

The researchers also said that the attackers used the same C2 address all this time. Given that the address is yet to be blocked on the IPVoid checking system, the researchers assumed that PY#RATION was flying under the radar for months. 

PY#RATION’s features include, among others, network enumeration, file transfer to and from the C2, keylogging, shell commands execution, host enumeration, cookies exfiltration, the exfiltration of passwords stored in the browser, and clipboard data theft.

To distribute the malware, the attackers are using the good old phishing email. The email comes with a password-protected .ZIP archive which, when unpacked, delivers two shortcut files, designed to look like image files – front.jpg.lkn, and back.jpg.lnk.

The “front” and “back” file names refer to the front and the back of a non-existent driver’s license. If the victims click the files, they’ll get two more files downloaded from the internet – front.txt and back.txt. These are later renamed to .bat files and executed. The malware itself tries to disguise itself as Cortana, Microsoft’s virtual assistant, to discourage its removal from the system.

The group behind the malware, the distribution volume, and the goal of the campaign, are all unknown at this time.

Via: BleepingComputer

You may also like

Leave a Comment

Our Company

newswebby is where tomorrow is realized. it is the essential source of information and ideas that make sense of a world in constant transformation. the newswebby conversation illuminates how technology is changing every aspect of our lives—from culture to business, science to design. the breakthroughs and innovations that we uncover lead to new ways of thinking, new connections, and new industries.


Subscribe my Newsletter for new blog posts, tips & new photos. Let's stay updated!

Laest News

© 2023  – All Right Reserved. Newswebby